Thanks to MJR, Wayne, Adrian, Dan and others who offered advice. We have now finished rebuilding my friend’s server and now the dust has settled and the anger and frustration has died down we have to admit it has not been a totally bad experience. It provided us with a good excuse, and opportunity, to reinstall everything from the ground up and made us realise what an enormous collection of no-longer-used scripts he had collected on his old machine; they were very handy at the time he installed them but he had forgotten to remove them once the need had passed.
I guess it has taught us, through experience, that just because my friend updated his operating system nightly we should not assume that EVERYTHING is updated and safe as old, no longer unused, no longer supported, scripts installed for a particular one-off task and then forgotten about can easily be overlooked but become an easy target for hackers.
I have a separate question about our experience but I had better start a new thread for that.
Thanks to all for your wise advice,
Sagr.